Introduction

Trellix IPS Manager provides an Application Programming Interface (API) framework for external applications to access core Trellix vIPS functionalities through the REST protocol.

REST stands for Representational State Transfer. It relies on a stateless, client-server and cacheable communication protocol – HTTP. It is an architecture framework for designing networked applications. RESTful applications use HTTP requests to post data (create and/or update), get data (query information) and delete data. Thus, REST uses HTTP for all CRUD (Create/Read/Update/Delete) operations. It is a lightweight alternative to mechanisms like RPC (Remote Procedure Calls) and Web Services (SOAP, WSDL, et al.).

To access a Manager Resource, you need to obtain the Manager 'Session' first. The Manager exposes login.jsp for performing the action of login to the manager. This internally calls forms in the Manager which updates the session object with the attributes which are used later in the filters provided in web.xml. The attributes being set comprises mostly user details, session details, and so on.

The following are the high level steps to access the Manager resource through REST APIs:

The following Python code snippet shows how to access the Manager using REST APIs:

#Step 1 - Get a session object. 
s = requests.Session()
#Use this session object for subsequent requests.

#Step 2 - Login to the manager.
url = "https://%s/intruvert/jsp/module/Login.jsp"%(ISM_IP)
payload = {
 'iaction': 'login',
 'Login%20ID':API_ISM_USERNAME,
 'password':API_ISM_PASSWD,
 }

response = s.post(url, data=payload, verify=False)
data = response.text

if data.find("../module/MainFrame.jsp") != -1:
 msg = "Logged in to manager"
else:
 msg = "Login Failed"
#Step 3 - Use the session object to make further requests.
headers = {
 ‘Accept’: ‘application/json’,
 ‘Content-Type’: ‘application/json’
 }

#Make a POST request to create a cluster.
final_url = https://localhost/intruvert/webservice/api/v1/cloud/cluster
payload = {
 "name": "TestClusterCreate",
 "description": "Testing cluster creation API",
 "sharedSensorKey": "testclustersharedkey"
 }
r = s.post(final_url, data=payload, verify=False, headers=headers)